1. FOIA, Privacy & Records Management Conference 2009
Office of the Administrative Assistant to the
Secretary of the Army
Records Management and Declassification Agency
Privacy FISMA and Public
Law Reporting
Leroy Jones, Jr. Evlyn Hearne
Army Privacy Office Army Privacy Office
(703) (703)

2. Federal Information Security Management Act
Part of the Electronic Government Act of 2002
Fundamental reasons for the Act:
Technology & automation throughout the government caused concerns about protection, use & disclosure of information maintained on individuals
Protect information & information systems from unauthorized access, use, disclosure, disruption, modification or destruction to ensure integrity, confidentiality and availability of data
At this link you will find ONE REASON FOR THE ACT talks about IMPROVEMENT OF THE METHODS BY WHICH GOVERNMENT INFORMATION, INCLUDING INFO ON THE INTERNET, IS ORGANIZED, PRESERVED, AND MADE ACCESSABLE TO THE PUBLIC.
*****
-Integrity, which means guarding against improper information modification or destruction
Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
Availability, which means ensuring timely and reliable access to and use of information.

3. Federal Information Security Management Act (con’t)
Key Principles:
Agency funding for automation contingent upon assurances of security and authorized collection & use
Privacy Impact Assessments (PIAs)
Analysis of automated systems containing Personally Identifiable Information (PII)
Annual and Quarterly Reporting
Statistics on a wide range of agency Privacy practices
Narrative descriptions and responses to directed questions

4. Federal Information Security Management Act (con’t)
Report Requirements
Numbers and Narrative Explanations
Systems of Records and Privacy Impact Assessments
Number required/reviewed and number published/completed
Scored under the President’s Management Agenda
Green 90% & above; Amber 80-90%; Red below 80%

5. Federal Information Security Management Act (con’t)
Training for all personnel (ALARACT )
Numbers of Reviews of:
Section M Contracts
Routine Uses
Exemptions
Matching Programs
Violations: Civil and Remedial Action
Statements

6. PUBLIC LAW 110-53 Implementing Recommendations of the 9/11 Commission Act of 2007
Purpose:
Review development & implementation of laws, regulations, procedures, policies, and guidelines relating to protecting the Nation against terrorism to ensure they balance with the need to protect individual’s Privacy
Delegations:
A senior officer to serve as the principal advisor to the department head & other officials in appropriately considering privacy concerns
DAASA appointed as the Army’s Senior Agency Official for Privacy
Agency Privacy Office to implement requirements, oversee & report
Army Privacy Office accomplishes

7. PUBLIC LAW 110-53 Implementing Recommendations of the 9/11 Commission Act of 2007
Key requirements:
Review development and implementation of:
Pending and enacted legislation
Agency Regulations
Policies and procedures
Establish procedures to redress privacy complaints
Provide advice on governmental powers and privacy
Submit quarterly reports to Congress & Privacy Board

8. PUBLIC LAW 110-53 Implementing Recommendations of the 9/11 Commission Act of 2007
Report composition
Number and types of reviews
Privacy Act System of Records Notices & Exemptions
Privacy Act Statements
Computer Matching Agreements
Types of Advice and Responses
Privacy Program Overview/Principles/Policy
SORNs and PIAs
SSN and PII Reduction Actions
PII Breach Reporting/Notification
Privacy Act Violations
Number of written complaints, description & disposition

9. Army Challenges Lack of awareness or understanding
Although information has been disseminated numerous times, a significant number of activities still don’t know about this requirement
Incomplete Reporting
Less than 1/3 of Army activities report
Personnel working with FOIA & Privacy (to include attorneys) are most likely giving occasional advice
Becoming difficult to ignore glaring omission from key activities
Track your numbers and report!
Make a sheet with the categories and record (tick mark) each instance
Report the numbers to your servicing FOIA/Privacy Office quarterly 8

10. Questions???